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ABSTRACT 



Six false alarms occurred at NORAD in 1978, 1979, and 

1980. These false alarms subsequently regenerated interest 
in launch policies and the increased possibility of acci- 
dental nuclear war, which motivated this investigation. Be 
construct a new model to address several questions: What is 

the sequence of events and reasonable timing between events 
in the missile warning system? How much time do decision 
makers have to respond to a threat? What effects do United 
States launch policies have on decision-making time? How 
likely is accidental nuclear war? 

The results show that accidental nuclear wac is not very 
probable with launch-under-attack, but significantly more 
likely if the United States adopts a launch-on-warning 
policy. The final decision and responsibility to use these 
policies, once they are implemented, rests entirely with the 
President of the United States. 
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I. INTRODUCTION 



Early warning information provides decision makers with 
a description of enemy forces as they prepare for, or actu- 
ally initiate, an attack. Given early warning, decision 
makers in the military and the government, including the 
President, can more adequately decide on a response during a 
crisis. When policy makers discuss changes to the regula- 
tions pertaining to the early warning system, they need to 
realize the implications of such policy changes on the 
system. This thesis presents the current early warning 
system, discusses proposed launch policies, and explores the 
possible results from implementing these policies. 

Warning information is essential for the survival of the 
many parts of our arsenal and its related control systems. 
For example, the bomber force depends on timely early 
warning so that it may scramble from ground alert to 
airborne stations where it is less vulnerable to nuclear 
attack. But the use of warning to save the bomber force, or 
any other weapon system, addresses only a narrow aspect of 
warning. The most important aspect of early warning is to 
give advance warning of an enemy’s attack, so that the deci- 
sion maker has a chance to give the appropriate response to 
an attack. Both the United States and the Soviet Union 
continue to build systems of extreme complexity for early 
warning. Intelligence systems have merged with warning 
systems, yielding one overall system which is integrated 
vertically with military forces. 

Future strategic technology is likely to make nuclear 
war more thinkable, especially as nuclear weapons spread to 
unstable countries less inclined to respect the nuclear 
threshold. The problem of nuclear weapons proliferation 
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concerns a large number of governments and is intimately 
related to the basic energy needs of both the developed and 
developing nations. It has fast become an issue of high 
politics on a global scale. Further, many of the developing 
nations claim that the United States, in the name of non- 
proliferation, seeks to implement policies that are highly 
discriminatory to the non-nuclear states and are designed to 
maintain American political, military, and economic power at 
the expense of the poorer nations. Hence, no global 
consensus exists on either the threat posed by nuclear 
proliferation or the steps that should be taken to deal with 
it. Instead, this issue inflames domestic debate in many 
nations, strains alliance relationships, sharpens the 
confrontation between East and West, and complicates 
concepts of national and international security. Within 
this framework of the threat of general nuclear war exists a 
concern for accidental or unintentional nuclear war. 

We are rapidly approaching a decisive point of demarca- 
tion in the history of the nuclear arms race; namely, the 
first strike counter-force threshold. This means both the 
arsenals of the Onited States and the OSSR will be highly 
vulnerable to surprise attack. As a result, efforts to 
control the momentum and direction of the nuclear arms race 
are increasingly complicated and the possibility for acci- 
dental war substantially grows. 

Senator Mark Hatfield describes the threat as our 
perception of a Soviet weapons build-up, a nuclear blackmail 
[Ref. 1: p. 3]. He describes the Soviet Intercontinental 
Ballistic Missile (ICBM) threat as impressive, yet destabi- 
lizing, because we can no longer rely on technology to save 
us from war. Following a decade of massive arms spending, 
the Soviet Union comes to the current round of disarmament 
talks with a suffering economy. Still, Hatfield claims, the 
United States strategists point to the Soviet’s apparent 
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superiority by counting the number of Soviet warheads and 
comparing this to the number of our warheads. In this 
paper, our real concern is not with the numbers question, 
but with how accurately and quickly we can discern if we are 
under attack and what should be the appropriate response. 
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II. BACKGROUND 



A. WHY STUDY THE PROBABILITY OF ACCIDENTAL NUCLEAR WAR? 

1 . The Histor i cal Pers pective 

From our everyday newspapers, we read about the 
increasing tension and anxiety surrounding the strategic 
forces of the United States. Since the close of World War 
II, the Western Alliance has feared attacks from the Soviet 
Union in Europe and in other United States defended territo- 
ries, as well as the subjugation of its power and ideals to 
the Communist philosophy. Of course, the Soviet Union fears 
the same from the West. In between the super powers lie the 
smaller nations, each wanting to expand their own influence 
and power in the world in ways similar to the super powers, 
especially by building or buying nuclear weapons. Thus, 
early warning systems have grown to extreme importance over 
the last thirty years. 

Looking at the Soviet warning system raises some 
deeply troubling issues. When it is examined as a system, 
and not merely as a physical collection of radars and 
computers, we see a consistency between doctrine and capa- 
bility. The Soviet doctrine is one of pre-emptive attack, 
and the Soviet capability is a system of warning and command 
that supports such a strategy. The Soviet experience of 
invasion may help to explain the reason for this approach. 

Ever since the Nazi’s attack in 1941, the Kremlin 
proscribed to the concepts of surprise attack, pre-emptive 
attack, and automatic firing. These policies fuel our 
apprehensions about the Soviets, particularly during times 
of crisis. As recently as July 1982, Defense Minister 
Dimitri Ustinov iterated the idea that the United States 
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should be denied the freedom of first use of nuclear 
weapons. At the same time, he hinted at renewed Soviet 
interest in a launch-on-warning policy. It is a mistake to 
discount Soviet statements as mere political bluff. Soviet 
threats contain exaggeration, but they also have a rationale 
that gives us insight into their thinking. Automatic or 
quick-launch systems are a preeminent design goal for the 
Soviet ICBIJ forces. These capabilities are not a by-product 
of Soviet technology; they are a guiding principle, and they 
continue to be an integral feature of the Strategic Rocket 
Forces (SRF) . 

The emphasis on pre-emption in Soviet peacetime 
doctrine is, of course, no guarantee that pre-emption would 
actually be used in a crisis. However, just the knowledge 
of a pre-emptive philosophy adds to our fear of surprise 
attack from Soviet forces. Also, it is unimaginable that 
the Soviets would operate their nuclear forces in a launch- 
on-warning mode during peacetime. The chief consequence of 
their emphasis on pre-emption may be that it serves as an 
indoctrinating force throughout their defense organization. 
However, once a country incorporates a view of war into the 
planning process, competing theories of conflict will prob- 
ably receive less attention. By building an arsenal and a 
training system directed toward pre-emptive attack, the 
Soviets preclude alternative strategies from consideration. 
Thus, it becomes more unlikely that plans could change at 
the last moment in a crisis. Now, in the 1980s, the Soviets 
have reached a virtual nuclear parity with the [Jnited 
States. With an increase in the certainty of a successful 
pre-emptive attack may come an increase in the probability 
of nuclear war if East-West tensions are not reduced 
[Ref. 2]. 
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2 . 



The Ca uses of the Concern 

The major threatening influence on the evolution of 
our warning system is the stationing of Soviet nuclear- 
firing submarines near the coastlines of the United States. 
Up until the late 1960s, Soviet submarines were located 
under the arctic ice cap. A launch of a Submarine-Launched 
Ballistic Missile (hereafter, SLBM) from that position 
provided some time for decision makers to discuss and recom- 
mend appropriate responses to that threat. Now, Soviet 
Yankee and De lta class submarines regularly patrol near our 
coasts [Ref. 3]. Depending on tactics and firing position, 
these submarines could fire SLBMs at our bomber bases and 
command centers with flight times ranging between 4 and 15 
minutes. Then, they can aim at Washington, the North 
American Aerospace Defense Command (NORAD) , and the 
Strategic Air Command (SAC) in an effort to paralyze the 
retaliatory forces of the United States. Even if our forces 
would be paralyzed only temporarily, an SLBM attack allows 
enough time to follow up with an all-out ICBM attack from 
Soviet missile fields. 

Another cause for concern is Soviet rhetoric. In 
the spring of 1983, Anatoly Alexandrov, the President of the 
Soviet Academy of Sciences, announced: 

"The Soviet Union will adopt a policy of automatic 
massive retaliation against all potential enemies if the 
new American medium-range nuclear missiles are deployed 
in Western Europe." [Ref. 4] 

Although the Soviets frequently hint at using a launch-on- 
warning posture, Alexandrov's remarks are more definite than 
previous statements of the Soviet position. Alexandrov 
claims that the current balance of strategic forces allows 
roughly 30 minutes for both sides to take steps to avoid a 
nuclear confrontation. (This refers to the ICBM forces, but 
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not the SLBM forces. ) He claims that the deployment of 
missiles in Europe would limit this time span to 5-7 
minutes; thus, precluding chances to avert an all-out 
confrontation. However, he fails to mention the SLBM threat 
which has about the same time span to avert a confrontation: 
5-9 minutes versus 25-30 minutes for ICBMs. Although the 
Soviet ICBM threat is potentially more destructive to our 
retaliatory forces, the SLBM threat severely shortens 
decision-making time which affects the launching of retalia- 
tory forces. 

The mechanisms which might precipitate an uninten- 
tional or accidental nuclear war entail our steady 
progression of technological advances in equipment, such as 
satellite sensors, and increasingly sophisticated computer 
software. These enhanced capabilities allow faster evalua- 
tion of events that take place in the atmosphere or space, 
as well as on the ground, and they provide a clearer picture 
of the global military situation. Yet, errors in the data 
gathering function (which includes all sensors, communica- 
tion links, and computer systems) already have caused f alse 
alarms at NORAD, our main surveillance center. In this 
discussion, a fa l se ala rm is a display from the data gath- 
ering system which indicates the launch of missiles towards 
a United States defended area with impact points in that 
area, but is, in fact, not real. Routine missile displays 
do occur every year, but NORAD does not label these as false 
alarms. Rather, NORAD resolves these routine missile 
displays using the usual surveillance procedures prior to 
any need for decisions from higher authority. 

Four false alarms, occurring in the fall of 1979 and 
the spring of 1980, received international attention 
[Ref. 5: p. 8]. However, NORAD located and corrected the 
problems surrounding these alarms without an inadvertent 
launch of retaliatory forces. Since then, the added care 
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taken in the entire missile warning system has helped to 
resolve incoming missile displays sooner, severely 
curtailing false alarms. No false alarms have occurred 
since 1980. 

Another contribution to the cause of accidental 
nuclear war is the greater international tension brought 
about by our increased nuclear stance and the inclusion of 
the Star Wars weapons system in our arsenal. This means 
that the United States is willing to take a risk to protect 
itself from the threat of an attack by establishing a 
launch- under-attack policy. Most Americans believe that 
their nation is not morally capable of initiating a nuclear 
war under any situation. Yet, the initiation of a policy, 
like launch-under-attack or launch-on- warning, sends a 
signal to our potential enemies. It is important in the 
interest of peace that the Soviets clearly perceive our true 
intentions. 

3. The Proble m of Accidental N uclear War 

The main goal of the United States military is to 
enhance the capabilities of our weapons if we must use them, 
and to increase weapon survivability if we are pre-emptively 
attacked. But we also desire the possibility of launching 
our weapons to be zero when we are not under attack. We can 
describe this conflict using a Type I/Type II error model. 

A Type I error occurs when an attack is coming, but the 
warning process fails and indicates that we are not under 
attack; thus, no counter-strike is launched. A Type II 
error occurs when no attack is forthcoming, but the warning 
process fails and indicates that we are under attack; thus, 
a counter-strike is launched when no threat exists, leading 
to an accidental nuclear war. The matrix in Figure 2.1 
below delineates the possibilities: 
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Figure 2. 1 Type I/Type II Error flatrix 

The two error types occur where the asterisks (*) 
are located. On the one hand, we want to lower the 
probability of not launching a retaliatory strike when we 
are under attack (the military does not want to make this 
mistake). On the other hand, we also want to lower the 
probability of launching a retaliatory strike when we are 
not under attack (i. e. , causing an unintentional nuclear 
war) . Note the trade-off involved with the two error types: 
we can not lower the probability of one error type without 
raising the probability of the other, due to the very nature 
of Type I/Type II errors. But we can continue to search for 
a policy which gives the best balance between Type I and 
Type II errors. 

4 . Pre vious Inv esti gations of the Problem 

The incidents of false alarms at NORAD generated 
several studies and sparked a renewed interest in launch 
policies. These studies focused on a need to watch false 
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alarms, since a false alarm that is not resolved could lead 
to accidental nuclear war. 



Bereaau built an analytical model on the self- 
activation of a nuclear weapons system [Refs. 6,7]. His 
model assumes that both the United States and Soviet warning 
and launch systems are interconnected: 



rxLSB alarm ► 



UNITED STATES 






SOVIET 


WARNING 






WARNING 


SYSTEM 


r \ 




SYSTEM 




\ 


/ 






1 

1 

1 

i 


\ / 
\ / 

\/ 

/\ 

/ \ 


i 

1 

1 

l 




/ 


\ 




UNITED STATES 


/ 


\ 


SOVIET 


LAUNCH 


/ 


\ 


Launch 


SYSTEM 






SYSTEM 



Figure 2.2 The Bereanu Model 



This gigantic system contains four components — the United 
States warning system, the United States launch system, the 
Soviet warning system, and the Soviet launch system. 

Bereanu argues that if the United States warning system 
responds to an alarm, it will automatically trigger the 
United States launch system which automatically triggers 
the Soviet warning system which automatically triggers the 
Soviet launch system all of which leads to a nuclear war. 
And, if this was a f alse alarm, it would lead to an acc i- 
denta l nuclear war. 

Bereanu’ s model also assumes that more and more of 
the human decision making will be turned over to a computer 
system. Thus, Bereanu implies that if the computer system 
errs and reports a missile launch when, in fact, no launch 
has occurred, the decision maker will automatically respond 
in kind; that is, launch a missile in retaliation. However, 
is the total system interlocked and automatic? This ques- 
tion will be addressed in the following chapters. 

Sennott and Crissey developed a computer simulation 
model and a queuing theory model to show how increasing 
false alarms lead to an increase in the probability of acci- 
dental nuclear war [Bef. 8]. The basis of their study 
revolves around the apparent increasing number of false 
alarms, but using a different definition of false alarm than 
we use in this paper. Sennott and Crissey define "false 
alarms" as conferences called to evaluate possible threats 
(which are otherwise known as missile display conferences) 
and use the data to predict the frequency of such threats in 
their models. They then claim that accidental nuclear war 
will occur if a false alarm takes too long to resolve. That 
is, if the time required to resolve the alarm exceeds the 
use t hem or lose them point, then retaliation is automatic. 
They also equated false alerts with threat assessment 
conferences. However, these definitions do not coincide 
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with NORAD’s definition of a false alarm (which is incorpo- 
rated into our definition) , and this difference may affect 
the conclusions of their research. 

Steinbruner discusses the background of the launch- 
under-attack policy, an ICBM scenario, and then centers on 
the command, control, and communications (C 3 ) problem 
[Ref. 9]. He also includes the Brookings model written by 
Morawski and Blair. This model simulates the performance of 
the C 3 system under four kinds of damage conditions and 
investigates the ability of the system to retaliate. The 
article concludes by stating that even our considering a 
launch-under-attack policy demonstrates the increasing 
tensions between ourselves and the Soviets. 

The authors mentioned above (as well as others 
referenced) hold the common view that the world is on the 
brink of accidental nuclear war. With increased interna- 
tional tension, coupled with the increasing number of 
missile displays, this conclusion might appear true on the 
surface. Even using the definition of a false alarm as 
delineated by Sennott et al, the apparent increase in these 
alarms may be explained by the following facts: (1) more 

sensitive sensors are on line and operators must continue to 
calibrate, test, and evaluate them; (2) the Soviets have 
increased their testing of missiles; and (3) the Joint 
Chiefs of Staff have revised the criteria for convening 
missile display conferences. Even if intelligence provides 
information regarding a test shot, NORAD continues to 
monitor, evaluate, and test its system on these live 
launches. Thus, the detection of any launch is added to the 
permanent record. 

Several of the authors assumed that the man-in-the- 
loop would lose control of the decision-making process by 
being left out at certain points in the process, or that the 
data gathering system makes the man-in-the-loop’ s decision 
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more automatic. On that basis, the decision to launch is 
then automatically carried out by the computer system. This 
view misses the intimate relationship between warning and 
alert levels on the one hand, and control of offensive 
weapons on the other. It also fails to consider the checks 
and balances (that is, the man-in-the-loop) set up 
throughout the entire missile warning system. 

Many differing opinions concerning different policy 
types and policy definitions exist among the authors cited. 
Sennott et al define launch-on-warning to mean if a situ- 
ation can not be called a non-threat, then it is a threat; 

. therefore, launch [Ref. 8: p. 2]. However, this definition 
does not completely cover the current decision process 
employed by NORAD. Steinbruner * s definition is very vague; 
he defines launch-under-attack (equal to launch-on-warning) 
as launching missiles after acquiring relia ble e vidence that 
a Soviet attack is underway before its actual effects are 
felt [Ref. 9: p. 37]. Bracken uses the term automa t ic 
retaliation, but defines launch-on- warning to include the 
military decision makers, who are given emergency authority 
to use nuclear weapons in advance of hostilities, and who 
are further instructed to use this authority if indications 
of an attack arise. Then, Bracken states that a launch-on- 
warning strategy does not require any computers or radar, 
although they are necessary to implement such a strategy 
smoothly. 

Although many different launch policies appear in 
different articles, only two stand out as viable alter- 
natives — launch- under-attack and launch-on-warning. As 
described above, definitions of these policies vary widely, 
depending on the source. Re offer clearer definitions in 
Chapter V and further pursue their implications. 

In all the cited articles, the authors hardly 
considered NORAD, left out the actual decision process, and 
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over-simplified or overlooked many assumptions. Although 
these discussions thoroughly delineated the problem, little 
has been written to answer the questions they raise. We 
investigate and discuss these questions in Chapters III and 
IV. 

B. METHODOLOGY OF THIS STUDY 

In the next two chapters, we discuss two parts of the 
missile warning f unction--data gathering and decision 
making. These two separate, yet interrelated, parts demon- 
strate the role the man-in-the-loop plays and the importance 
of maintaining this role as we consider the implications of 
certain launch policies. 

The Data fathering Model completely covers all of the 
mechanical aspects — sensors, ground stations, command 
posts — as well as describing decision rules, such as dual 
phenomenology. The Data Gathering Model also presents 
several scenarios of interest with an accompanying sensi- 
tivity analysis to show how time affects the decision-making 
process. 

The Decision Model adds decision points to the Data 
Gathering Model and incorporates in greater detail the same 
scenarios from the Data Gathering Model. The sensitivity 
analysis further directs attention toward the need for a 
policy to balance the current situation. In Chapter V, we 
discuss two types of launch policies and their implications. 
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III. D ATA GATHER ING MODEL 

A. THE CURRENT MISSILE ATTACK WARNING SYSTEM 

The Missile Attack Warning System consists of three 
parts: (1) sensors to detect a missile launch, (2) computer 

centers and communication links to process and distribute 
the data from the warning system, and (3) command posts 
which analyze data and assess the implications of the 
warning information and direct appropriate actions. Major 
components of each of the above parts follow: 

1 . Missile Warning Sensor s 

a. Satellite Early Warning System (SEWS) 

— detects infrared trail of a burning missile motor 

— provides overlapping coverage for the Soviet Union and 
China (for ICBMs) 

— provides overlapping coverage for the Atlantic and 
Pacific Oceans (for SLBMs) 

— transmits real-time information due to the nature of the 
SLBM detection problem 

--ground stations process and forward data to the command 
posts 

b. Ballistic Missile Early Warning System (3MEWS) 

(1) Large Tracking Radar in Greenland, England . 
and Ala ska. 

— detects and continuously searches for an object 

--operates on several UHF frequencies 
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-provides precise data on the character and magnitude of 
a missile attack 

(2) S tatic Radar in Greenland a nd Alaska. 

-evaluates missile position and velocity 

-calculates the trajectory, impact point, impact time, 
and launch point 

c. Pave Paws 

-a large multi- targeting phased array radar in California 
and Massachusetts 

-operated and maintained by the Strategic Air Command 
-primarily detects SLBMs 

-relays the characterization of the attack to NORAD, SAC, 
and the National Command Authorities (NCA) 

-simultaneously detects and discriminates many objects 
while providing early warning data, launch, impact, 
position, and velocity information 

-provides automatic detection, track initiation, and 
mission decisions 

-operates at UHF frequencies 

d. Perimeter Acquisition Radar Attack Character- 
ization System (PARCS) 

-located in North Dakota 

-tracks incoming ICBMs 

-directs the launching of missiles 

-very accurate 
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e. Two Radars in the Southern United States 
— long range phased array radars 

--uses pattern recognition of current space objects 

--back-up system performs a full search with human 
intervention 

— operates on UHF frequencies 

— supplements SLBM detection from the Gulf of Mexico 

--receives inputs from BMEWS and the United States Navy 
Space Surveillance (SPASUR) network 

f. Cobra Dane 

— a large, real-time tracking phased array radar in the 
Aleutian Islands of Alaska 

--detects and tracks ICBMs, SLBMs, and satellites 

— predicts impact points 

— primarily collects intelligence data 

2. Gro und Pro ce ssing and Communic at ion S ys tem 

— ground stations in the continental United States and 
overseas which process the data from the sensors 

— communication processing stations co-located with the 
sensors 

A thorough discussion of the communication function follows 
later in this chapter. 

3 . Command Posts 

a. North American Aerospace Defense Command (NORAD) 
— described later in Section D of this chapter 
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b. Strategic Air Command (SAC) 

--located (underground) in Omaha, Nebraska 

--has the authority and responsibility to launch the 
nuclear bomber force to protect it 

— maintains a small percentage of the bomber force on 
constant alert 

— operates and constantly maintains an airborne command 
post 

c. National Military Command Center (NMCC) 

— located in the Pentagon 

— anticipates and evaluates foreign crises 

— point of contact for the President to obtain information 
and command the nuclear forces 

d. Alternate National Military Command Center 
(ANMCC) 

--located (underground) in Fort Richie, Maryland 

--acts as the alternate location for NMCC with the same 
functions as NMCC 

The missile warning system employs a two-step process 
for identifying a missile launch and assessing the threat to 
the North American continent. First, the infrared warning 
satellites detect the infrared signature of a burning 
missile motor. Ground-based radars provide back-up confir- 
mation data and rely on detection using a different physical 
phenomenon; i. e., radar tracking of a physical object as 
opposed to detecting the infrared signature. This two-step 
process is called dual phen o menolog y and minimizes the like- 
lihood of mistaking some natural phenomenon for a launch of 
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an enemy’s missile. For the purposes of this thesis, dual 
phen om enology means the use of different types or families 
of sensors to detect the same launch. 

The SMEWS radar confirms and characterizes a polar ICBM 
attack. Pave Paws radar detects SLBM launches and SEWS 
covers both ICBMs and SLBMs. Thus, after the detection of 
an infrared signature, the BMEWS radars would be the first 
to detect ICBMs; the Pave Paws radar would be the first to 
detect SLBMs launched off either coast. The two radars in 
Florida perform the same function as the Pave Paws radar for 
missiles coming from the Gulf of Mexico. 

The satellites and Pave Paws radar, the two sensors that 
detect the attack of SLBMs, feed their data directly to all 
four major command posts (so all four receive and evaluate 
the data simultaneously) . In addition, NORAD transmits its 
analysis of any SLBM attack to the other three command 
posts. Thus, the duty officers at the other sites have two 
separate computations and displays of the SLBM launches. 

Data from all other warning sensors feed only into the NORAD 
command post, where it is analyzed. The other three command 
posts then receive the results of the NORAD analysis by 
transmission over the communication lines. 

In order to ensure that the communication lines between 
NORAD and the other three command posts remain open, NORAD 
constantly transmits messages to the other sites over 
circuits that would transmit an actual attack. Normally, 
this message contains test data so that all three sites can 
monitor the condition of their communication links from 
NORAD. If the system works properly, all command posts 
receive similar information. When any indication of a real 
threat exists, including ambiguous data, the four command 
posts begin a conferencing procedure to evaluate and assess 
the data available. 
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If the Soviets launch SLBMs and ICBMs separately or 
simultaneously, the following sequence of events prohahly 
would occur: 

1. Satellites detect launches of SLBMs or ICBMs shortly 
after launch. 

2. Pave Paws radar picks up the SLBMs 2-5 minutes after 
launch. 

3. BMEWS radar picks up the ICBMs within 10 minutes of 
their launch. 

4. PARCS radar picks up the ICBMs in the terminal phase 
of flight. 

Approximately 9-12 minutes exist between launch and impact 
of an SLBM. Time between launch and impact of an ICBM is 
approximately 25-30 minutes. Since an SLBM can destroy a 
large portion of our ground-based sensors and command posts, 
the time our current system is fully operational could be 
severely shortened. This does not mean that the entire 
system would disappear at the end of the approximate 9 min- 
ute period. But then we could only depend on those assets 
that survive the initial attack; that is, assets that are 
airborne in time to escape the attack. Thus, the short 
interim between detection of an attack and destruction of 
the major portion of our command and control structure puts 
a severe stress on the decision maker. 

B. SENSOR PROCESSING 

The sensor evaluation process entails the following 
steps: 

1. An event triggers a sensor. 

2. The satellite sensor relays a signal to its respective 
ground station. 
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3 . 



The sensor ground station computer interprets the 
radar signals. 

4. The computer system analyzes the signals. 

5. The computer system relays its analysis to the system 
operator . 

6. The computer system generates a message to the command 
posts. 

7. The command post verifies if an actual message was 
sent . 

8. The sensors continue to follow the path of the object 
and send update messages . 

In every step of the above procedure, the man- in-the- 
loop observes and evaluates the processed data. Therefore, 
the processed data will be declared a false alarm if, in the 
experience of the man-in-the-loop, the processed warning 
data indicates a false display of a launch which may be 
caused by some natural phenomenon, or the man-in-the-loop 
has little confidence in what the computer system tells him 
about the supposed threat. Likewise, if a computer compo- 
nent fails, perhaps generating a false display, but the 
sensors never register a missile launch, then the man-in- 
the-loop will also recognize this as a false alarm. 

C. COHHAND CENTER PROCESSING 

Both NORAD and SAC receive missile warning data from 
SEWS and Pave Paws radars. NORAD receives data from BMEWS, 
Cobra Dane, and PARCS radars and sends summary messages to 
SAC. NMCC and ANMCC receive only a summary of the missile 
warning data from NORAD. Since NORAD obtains more informa- 
tion (ICBM and SLBM data) than any other command post in the 
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system, the Commander-in-Chief of NORAD (hereafter, CINC 
NORAD) assesses the sensor warning data. 

If the data gathering system indicates a launch, 
specialized centers in the Cheyenne Mountain Complex are 
activated. The Missile Warning Center calls the individual 
sensor sites to confirm the validity of the indication of 
launched missiles. The Space Center states whether the 
indicator is or is not one of the over 4,000 objects already 
in space. The Solar Center reports any solar activity. The 
Intelligence Center discloses any infocmation which would 
add to the definition of the indicator. With all this 
information combined, CINC NORAD makes a total assessment of 
whether the indicator is a real launch threat to North 
America. 

If the satellites trigger the warning process, any one 
of the four command posts can call a con ferenc e. At the 
conference, CINC NORAD makes decisions regarding the 
threat/no threat situation evaluated by the sensors with 
inputs from the other command posts. We discuss this 
conferencing procedure in detail in Chapter IV. 

D. NORAD’S ORGANIZATION AND MISSION 

1. The Sarly History of N ORAD 

To better understand the Data Gathering Model, and 
later, the Decision Model, it is important to realize where 
NORAD fits into the picture and how NORAD 1 s mission affects 
the question of accidental nuclear war. 

By the mid-fifties, the United States Air Force had 
the technology of continuous warning information. Only by 
redesigning their formal organizational structure to fit 
this new information technology could the Air Force pros- 
ecute a war successfully. This resulted in the creation of 
NORAD in 1957. As the central processor of real-time 
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warning information, NORAD became a joint United States- 
Canadian command because of the location of radars and 
fighter bases in Canada. Its job included the integration 
of BMEWS, Sound Surveillance System (SOSUS) , Distant Early 
Warning (DEW) Line, and other information sources for an 
overall warning estimate that would be relayed to other 
command centers, such as SAC and the Pentagon. 

NORAD is the central command post for continuously 
monitoring warning and intelligence information from 
multiple sources. It is, then, the central coordinating 
institution responsible for determining when the United 
States is under attack. 

NORAD serves a critical alerting role in an elabo- 
rate system of institutional checks and balances to prevent 
unauthorized or inadvertent use of nuclear weapons, either 
of which could lead to a nuclear war. The Commander-in- 
Chief of SAC (hereafter, CINC SAC) does have the authority 
to order the launch of the bomber force in order to prevent 
its destruction on the ground by incoming enemy missiles. 
However, this authority depends crucially on the threat of 
incoming enemy attack, a condition determined by CINC NORAD. 

2 . Today * s NORA D 

Today, NORAD is a bi -national partnership between 
the United States and Canada; CINC NORAD is also the 
commander of the United States component, the Aerospace 
Defense Command (ADCOM) . Canadian forces come from the 
Canadian Forces Air Defense Group, headquartered at North 
Bay, Ontario. The senior representative of the Canadian 
Forces is the Vice Commander-in-Chief of NORAD. CINC NORAD 
reports to the Joint Chiefs of Staff (JCS) as representing 
the Specified Command, ADCOM. As the Commander of Aerospace 
Defense Center, he reports directly to the Chief of Staff of 
the Air Force. 



The NORAD mission includes: 



(1) Tactical warning and attack assessment of bomber or 
ballistic missile attack on North America 

(2) Space surveillance, tracking, and cataloging of all 
human-made objects in space 

(3) Satellite protection of friendly satellites, pro- 
viding collision-avoidance and other flight 
condition information 

(4) Satellite attack warning and verification for all 
United States satellites 

(5) Peacetime surveillance, detection, and identification 
of aircraft 

(6) Support for the Space Shuttle missions 

(7) Operational control of United States and Canadian Air 
Defense Forces 

Also, NORAD has the responsibility to JCS to provide world- 
wide detection of missile launches and nuclear events. This 
includes the Pacific area and Europe, as well as the area 
adjacent to the North American Continent. 

To accomplish its mission, NORAD exercises opera- 
tional control of the detection and communications systems, 
and it operates and maintains the analytical systems in the 
NORAD Cheyenne Mountain Complex (NCMC) . NCMC provides NCA 
and CINC SAC with real-time missile warning messages and 
NORAD confidence assessments. 

The NORAD command post is in the underground 
Cheyenne Mountain Complex in Colorado. A worldwide network 
of sensors gathers and processes missile warning information 
and distributes warning messages to other United States and 
Canadian command posts. 
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NORAD does not engage in any active defense such as 
ballistic missile defenses designed to intercept ICBMs and 
SLBMs. This task is reserved for SAC. Specifically, NORAD 
employs passive defenses that protect targets by such means 
as warning, mobility, and sheltering forces. 

E- DATA GATHERING MODEL FORMOLATION 

In order to formulate the Data Gathering Model, we must 
establish several basic assumptions about the data gathering 
process. Three examples then illustrate the importance of 
time: we will model an ICBM scenario, an SLBM scenario, and 

a test shot scenario. 

First, we assume the timely detection of incoming 
missiles. Timely detection of missiles determines how 
quickly a response to an actual or imagined threat can be 
made. Success in preventing an accidental nuclear war, or 
in protecting strategic forces, depends on the fastest 
possible identification: the sooner an incoming object is 

identified as a threat or non-threat, the more time is 
available for decision makers to consider appropriate 
responses. 

Second, we assume that communications remain intact over 
the entire system until the missiles impact. This assump- 
tion requires some explanation. As discussed in Steinbruner 
[Ref. 9: p. 40], an electromagnetic pulse (EMP) from an 
exoatmospheric nuclear explosion would cause interruption of 
non-hardened and long range (HF, LF) communications. To 
overcome the effects of EMP, redundant messages sent over 
the communication lines contain less information, ensuring 
that some information gets through the system. However, it 
takes at least 7 minutes after an SLBM launch before the 
first exoatmospheric explosion occurs. Also, we will not 
consider sabotage or human errors which could also disrupt 
communications. 
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Third, we assume that the computer system, which 
contains a large number of components (both hardware and 
software) , has high reliability. Performance of the missile 
warning task requires the use of computers and high-speed 
communication systems which both sometimes produce erroneous 
data. However, dependency on computers does not imply 
control by them, since the data gathering system only 
reports and evaluates missile warning data while a 
compl etely diff ere nt computer system controls the procedure 
for launching missiles. At every step of the process, 
experienced personnel evaluate and judge the meaning of the 
incoming data. Only these trained personnel can direct any 
action in response to what the warning system reports. 
Thorough investigations of previous false alarms led to more 
stringent policies and practices throughout the missile 
warning system, severly curtailing the possibility of an 
inadvertent launch. The additional vigilance of the man-in- 
the-loop makes inadvertent launches even less likely. 

1 . The Gen eric Model 

As stated before, the Data Gathering Model consists 
of a continuous time line broken into finitely many (some- 
times overlapping) segments, each of finite duration: 

ti»e of flight t J~l— i““4 

launch impact 

Figure 3. 1 The Generic Data Gathering Model 

where tO = time of launch 

tl = first detection 

t2 = system evaluation of launch (threat/no 
threat ) 
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t3 = second detection 



t4 = assessment of launch by decision makers 
(threat/no threat) 

t5 = last possible time to decide on the 
type of response (launch/no launch) 

t6 = time of impact 

The time line, over which observations are taking 
place, starts with the friendly forces detecting the 
launching of missiles, and ends with the impact of missiles. 
Each t(i) is the time when the data gathering system de- 
tects, evaluates, and completes its analysis of the sensor 
data and passes along the information to the decision-making 
system so evaluation of the threat can be resolved prior to 
impact. The minimum time to reso l utio n (that is, the min- 
imum amount of time in which to make a decision to launch or 
not launch) = (t5-t3). Note that tO, t5, and t6 are fixed 
points, and if t4 is greater than t5, a serious problem 
arises. In the following examples, the time sequence 
remains the same. 

2 . Examp les 

a. ICBM Scenario 

Starting with the least stressful situation, an 
ICBM launch scenario, the model describes the following: 

tO tl t2 t3 t4 t5 1 6 

time of flight I 1 1 ] 1 1 I 

6 i 3 5 7 27 30 minutes 

launch impact 

Figure 3.2 An ICBM Scenario 
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As in the general case above, the definitions of to through 
t6 remain the same. The minimum time to resolution of the 
threat is (t5-t3) = 22 minutes. 

b. SLBM Scenario 



The model below describes an SLBM launch 

scenario : 



tO tl 1 2 t3 1 4 t5 1 6 

time of flight I 1 I 1 1 1 1 

0 i 3 5 7 9 12 minutes 



launch impact 

Figure 3.3 An SLBM Scenario 



Again, the definitions for tO through t6 remain 
the same. Notice that the time of flight for the SLBMs 
extremely shortens the amount of decision and response time. 
Here, the minimum time to resolution is (t5-t3) = 4 minutes. 

c. Test Shot Scenario 

The model below describes the situation where 
the data gathering system monitors test shots of missiles: 

tO tl t2 t3 1 4 t5 1 6 

time of flight I 1 1 1 1 1 1 

0 1 3 5 7 9 22 minutes 

launch impact 

Figure 3.4 A Test Shot Scenario 



Usually, in a test shot, the Intelligence Center 
informs CINC NORAD that a test shot has been scheduled. 
However, whether or not intelligence is available, the data 
gathering system treats a test shot as a regular launch and 
calculates an impact point. By t3, the decision makers 
realize it is a test shot, but continue the assessment 
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process for intelligence gathering. In this example, the 
minimum time to resolution is (t5-t3) = 4 minutes. 

F. SENSITIVITY ANALYSIS 

The critical area of sensitivity analysis lies in the 
data processing times in the above three examples. The 
longer it takes to process incoming data, the lass time 
remains to make important decisions on whether we should 
launch our missiles. Thus, shorter processing times buy 
more decision time (which becomes more precious as the 
scenarios get more complex) . 

Some uncertainty exists in the Data Gathering Model. 

For instance, sensors and computer hardware components do 
fail, computer software is not totally error free, and 
computer operators do make errors. All of these failures 
have occurred at least once at NOHAD [Ref. 5: pp. 5-9]. 
However, in every case, NORAD did discover the error and 
improve its data gathering system. 

In reality, the time segments of the above Data 
Gathering Model are not as neat and precise as described. 

As stated before, these segments overlap and, sometimes, one 
event will occur before another. 

Since satellites view the world from one vantage point 
and ground stations view it from another, some discrepancies 
arise that could cause problems. For instance, if SEWS 
picks up a launch in one place, but Pave Paws picks it up in 
another, the system may display two launches even though 
only one has actually occurred. Sometimes 4-5 missiles look 
like 30, especially when debris is present. These possibil- 
ities make it harder for the decision maker to state high or 
low confidence in the assessment to the President and have 
an effect on the President’s own response decision. 
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In the scenarios below, we explore the ramifications of 
the overlapping time segments. 

1. The ICBH Threat 

The interval between tO and tl is split into two 
pacts. In the first 30 seconds, a q uic k look report flags 
some phenomenon which could be a launch. In the next 1.5 
minutes, the initial report follows with the probable point 
of launch (the azimuth) and the direction of launch. This 
information assists the decision maker in determining 
whether the launch is real or the system has failed. Since 
processing occurs in the satellite and at ground stations, 
the time from tO to tl could be more than 2 minutes, when 
the system delays to discriminate between a natural phenom- 
enon and a real launch, or when the decision maker calls a 
ground station to confirm the display on the command post’s 
computer monitor. In any case, when several satellites pick 
up a possible launch, the data gathering system automati- 
cally attempts to merge the individual reports into a single 
message, then transmits this message to the decision maker. 

In the interval between tl and t2 (about 30 sec- 
onds) , the data gathering system evaluates the possible 
launch, and by t2, labels it a threat/no threat. The next 
interval, from t2 to t3, which allows time for a second 
detection, can become quite large. Depending on what sensor 
picks up the launch, and the launch trajectory, this 
interval could be anywhere between 3 and 7 minutes in 
length. The interval between t3 and t4 is approximately 30 
seconds. Figure 3.5 graphically represents these overlap- 
ping intervals. 

We now explain the reason for the 3-7 minute 
interval from t2 to t3. There are four major phases in 
launching an ICBM: boost, post-boost, mid-course, and 

re-entry. The boost phase usually lasts several hundred 
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3 



21 



minutes 



2 0.5 7 0. 5 17 3 minutes 

tiM of night — ti — 

launch impact 

Figure 3.5 The ICBH Time Line 

seconds, during which the missile starts at rest and accel- 
erates to about 7 kilometers/second by the time it reaches 
an altitude of about 200 kilometers. Typically, an ICBM is 
a three-stage rocket, each stage contributing more than 2 
kilometers /second to the missile velocity. During the boost 
phase, satellite sensors can easily detect the launch, and 
the missile is relatively vulnerable. 

In sophisticated missile systems, a post-boost or 
deployment phase follows the boost. This phase may last 
another several hundred seconds. During this phase, a post- 
boost vehicle maneuvers to achieve a variety of very precise 
trajectories, and then deploys individual re-entry vehicles 
on each trajectory. The post- boost vehicle carries a very 
accurate inertial guidance system to determine its position 
and velocity. It maneuvers to correct any trajectory errors 
produced during the boost phase and places the individual 
re-entry vehicles on slightly different trajectories to 
attack different targets. The individual re-entry vehicles 
are commonly known as Multiple Independently Targetable 
Ee-entry Vehicles (MIRVs) . Since the post-boost vehicle 
uses a much lower thrust level than the booster, the rocket 
exhaust is much less visible to sensors. 

After the re-entry vehicles are deployed , they 
follow their respective trajectories for approximately 1000 
seconds, climbing to 1000 kilometers, and then falling 
towards the earth, eventually re-entering the atmosphere. 
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This is the mid-course phase. The final phase is re-entry 
and lasts from 30 to 100 seconds, depending on the specific 
trajectory and drag characteristics of the re-entry vehicle. 
Figure 3.6 depicts three types of trajectories for an ICBM: 




Figure 3. 6 Three Possible ICBM Trajectories 

Lofted trajectories (high re-entry angles) result in 
greater re-entry vehicle deceleration, thus, requiring an 
increased time of flight, since the flight path is longer. 
However, this results in a much higher accuracy in hitting 
the target. 

In depressed trajectories (low re-entry angles), the 
re-entry vehicle heats up more, reducing the accuracy of the 
missile. Note that the Pave Paws radar (for example) will 
not pick up a depressed ICBM trajectory as quickly as it 
picks up the other two types of trajectories. For both 
radar and infrared sensors, the difficulty of the sensor's 
job increases with increased range and increased field of 
view . 



40 



A given booster delivers a given payload to its 
greatest range on the minimum energy trajectory and, hence, 
is the most likely trajectory. This means that the minimum 
time (shortest interval) to reach t3 for a lofted or minimum 
energy trajectory is about 5.5 minutes. In the ICBH scen- 
ario, 21.5 minutes remain for decision-making time before a 
final response is required, and 24.5 minutes remain' before 
impact of the missile. The maximum or longest interval of 
time, (t3-t0) = 9.5 minutes. Since the decision maker will 
probably take 30 seconds to make an assessment of high or 
low confidence, this allows the President about 21 minutes 
in the minimum case, and 17 minutes in the maximum case, to 
make his response (see Table I) . 

The minimum interval between t5 and t6 is about 3 
minutes. This covers the reaction time requir ed to launch 
our missiles in a retaliatory strike. Reaction time 
includes the encryption of messages to launch, the decryp- 
tion of those messages upon receipt, double-checking the 
messages for accuracy (that is, are they real orders?), and 
the required number of personnel on the scene to unlock and 
operate the missile system. Since we have never had to 
perform this function, other than in a training exercise, 
this minimum reaction time does not include any failures of 
components in the launch system preventing the launch, fail- 
ures of any personnel to perform their duties, nor any other 
uncertainties that may occur. A more realistic time is 
closer to 6 minutes. This amount of time accounts for the 
completion of actions from the above 3 minutes, plus any 
extra time for shock, confusion, dismay, denial, and undue 
pressure that would arise from receiving a real launch 
order. However, using 6 minutes as a maximum time required 
to perform the launch sequence still leaves the President 18 
minutes to decide a response to the threat in the minimum 
case, and 14 minutes in the maximum case. 
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The SLB3. Threat 

The time intervals up to and including t3 remain the 
same here as in the ICBM scenario. However, the situation 
drastically changes in this scenario due to the much shorter 
time of flight of an SLBM; 

3 3. 5 3 minutes 

2 0.5 7 0.5 0 2 minutes 

u “ of fli9ht ti — -y“ "d — -;4 — U 

launch impact 

Figure 3.7 The SLBH Time Line 

Figure 3.8 below depicts the usual SLBM trajectory 
(about 1000 miles from shore) together with a depressed SLBM 
trajectory. This graph reveals that to obtain dual phenome- 
nology (using Pave Paws as an example) , the time between t2 
and t3 will increase with a depressed SLBM launch. This 
result severely shortens the time for the decision maker to 
assess the situation. 

The graph in Figure 3.9 shows the usual SLBM trajec- 
tory together with an SLBM launch at 500 miles from the 
coast (about as close as a submarine can get to launch an 
SLBM if it is to hit its target). When launching an SLBM, 
the trajectory will probably be lofted to attain enough 
speed and height to successfully re-enter the atmosphere and 
hit its target. Although this lofted trajectory is less 
accurate in hitting the target, the interval between t2 and 
t3 increases while the overall time of flight (tO to t6) 
decreases. This results in decreasing the decision makers’ 
time. Therefore, the closer the launch is made to the 
coast, the less time remains for the decision maker. 




Figure 3.8 Two Possible SLBM Trajectories 



i 1 




Figure 3.9 Two Possible SLBM Trajectories 

Becall that the minimum time to reach t3 is 5.5 
minutes. In the SLBM scenario, this time leaves 3.5 minutes 
decision-making time before the last moment a response can 
initiate a retaliatory launch, and 6.5 minutes before the 
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impact of the missile. The maximum time is (t3-t0) = 9.5 
minutes, which allows no decision-making time and 2.5 
minutes to impact. This analysis explains why an SLBM 
launch is so stressful for ,the decision maker. 

The decision maker will probably take about 30 
seconds to make an assessment and state either high or low 
confidence. In the minimum case, this leaves 3 minutes for 
the President to take action. In the maximum case, the 
situation has advanced beyond the cut-off time to initiate a 
launch order. 

With 6 minutes as the maximum time required to 
perform a launch sequence, that is, (t6-t5) = 6 minutes, a 
decision maker would have sufficient time for assessment 
since the minimum resolution time (t3-t0) =5.5 minutes, but 

if the assessment takes the usual 30 seconds, no time 
remains for the President. If the resolution time is 
anywhere from the minimum (t3-t0) = 5.5 minutes up to 6 
minutes, the United States could still execute an actual 
launch order in time. This situation illustrates that the 
demand for reliability in dual phenomenology and reporting 
high confidence, plus the demand for reliability in a launch 
order, puts the decision maker in a severe time crunch. In 
the case where t4 occurs after t5 , or when an SLBM is 
launched from 500 miles vice 1000 miles, the overall system 
permits no decision-making time at all. 

The new capabilities of the cruise missile present a 
worse case scenario shown in Figure 3.10. Currently, the 
United States has no policy to deal with cruise missile 
launches. With such a short warning time, a bomber attack 
may be the only response possible. Although the cruise 
missile is a limiting case (so we will not discuss it at 
length here) , it is an important subject for future investi- 
gations. 



44 



PAVX PAYS 1AIUB 



fcfnriWUM EBKBCY (XOftUAL) TRAJECTORY 



CRUISE MISSILE 


TRAJECTORY 


\ / 
X .f 




IMPACT 

I 




1000 MIU3 


Figure 3,10 J 


Cruise Hissile Trajectory 




The table below 
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the above analysis: 










TABLE I 






Time Remaining 


in the Data 


Gathering Model 




Interval 




ICBH 


SL3M 


First Detection 




28 


10 


System Evaluation 




27.5 


9.' 


Second Detection 


minimum 


24.5 


2. 




maximum 


21. S 


6.: 


CINC NORAD's Assessment 


minimum 


24 


2 




maximum 


27 


6 


President's Time 


minimum 


17 


0 


(3 minutes to impact) 


maximum 


21 


3 


President’s Time 


minimum 


14 


0 


(6 minutes to impact) 


maximum 


18 


0 
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IV. DECISION MODEL 



A. DESCRIPTION OF THE CURRENT DECISION PROCESS 

The missile warning function involves two major Air 
Force commands — NORAD and SAC. NORAD has the responsibility 
for the management, maintenance, and operation of all the 
early warning sensors, in addition to the overall air and 
space defense of the United States. CINC NORAD has the 
responsibility for the management and operation of the 
command post at the Cheyenne Mountain Complex, plus the 
responsibility for the interpretation of missile warning 
data sent from SAC. 

SAC’s responsibilities include maintaining the airborne 
command post, which conveys the launch order if the under- 
ground command post is wiped out. SAC is also responsible 
for operating its computer system, which receives missile 
warning data from SENS and NORAD. CINC SAC is personally 
responsible for keeping the bomber and tanker forces in a 
ready status in case they must be launched for surviv- 
ability. When launched, the bomber force does not proceed 
with an attack, but follows orders to go to holding posi- 
tions where it waits for orders either to commence an attack 
or return to base. SAC repeatedly practices this launching 
procedure (using a small percentage of the force) to keep 
the bomber forces continually ready. 

A number of questions concerning IC3M silo vulnerability 
and the missile accuracy of the Soviet SLBMs and ICBMs 
persist. The big question in the decision model is "Will 
our ICBMs be able to ride out an attack?" If we believe in 
silo vulnerability and decide to launch a percentage of the 
ICBMs in the event of a real threat, then the ICBMs are 
committed and can not be recalled. In this situation, the 
decision maker must face the decision to "use them or lose 
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them." On the other hand, the other two legs of the stra- 
tegic triad, submarines and the bomber force, are less vuln- 
erable when deployed. These forces also remain under strict 
human control at all times. Bombers can be recalled easily 
from their holding stations, but the submarine forces have 
more flexible instructions. These instructions restrain 
submarine commanders from launching missiles without author- 
ization or allow them to maintain a neutral position. 

Generally, the more missiles launched, the easier it is 
to decide a threat/no threat situation, since a massive 
launch strongly indicates a real attack. The problem arises 
when only one missile appears, if the sensors detect some 
natural phenomenon, if spurious warning data enters the data 
gathering system, or if a component in the system fails. If 
the indication of a launch comes from the ocean, this 
heightens the problem even more, since less time is avail- 
able to evaluate, assess, and respond to the threat. If 
CINC NORAD assesses a single missile threat with high confi- 
dence, the President’s decision problem becomes extremely 
difficult. 

Next, we discuss three major components of the Decision 
Model conference procedure: (1) the missile display confer- 

ence, (2) the threat assessment conference, and (3) the 
missile attack conference. 

1 . The Missile Dis play Co nf erence 

Opon detecting a possible launch, the missile 
warning system passes its analysis of threat/no threat to a 
decision maker, and a formal missile display conferencing 
procedure convenes to evaluate and assess the analysis. Any 
of the four duty officers at the command posts may call this 
initial conference, if the data gathering system at the 
command post indicates a possible threat. CINC NORAD calls 
a routine missile display conference whenever changes to the 
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system (such as position or configuration changes to 
sensors) , cause unusual information or conflicting data to 
appear. 

Since we must maintain a highly sensitive system, 
many indications of detections arise that are evaluated as 
not being associated with a real missile launch. Every year 
many missile display conferences are called to deal with 
events other than potentially threatening or ambiguous 
missile launches. 

CINC NORAD officially terminates a missile display 
conference when the decision makers judge the available data 
to indicate either the presence or absence of a threat to 
North America. If the perceived threat turns out to be some 
natural phenomenon such as a solar reflection, CINC NORAD 
terminates the missile display conference, declaring the 
situation as no threat. System operators at NORAD call the 
ground sites to confirm what appears on their displays. If 
nothing appears on the displays at the ground sites, the 
system operators at NORAD will then trace the problem, but 
CINC NO RAD will not call a threat assessment conference (the 
next conference in the decision process) . However, if the 
situation at NORAD agrees with the display at the ground 
stations, it is considered a threat. CINC NORAD then termi- 
nates the missile display conference and takes the next step 
by calling a threat assessment conference. 

2 . The Threat A ssess me nt Con feren ce 

As stated above, if CINC NORAD judges a launch to be 
a threat by confirming the incoming data with the ground 
sites, he convenes a threat assessment conference. This 
conference requires the addition of more senior personnel to 
assist the duty officers at the various command posts in 
their evaluation of the confirmed threat. Senior personnel 
include the Chairman of the Joint Chiefs of Staff. These 
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personnel confer in order to determine the nature and magni- 
tude of the threat to North America, and they direct prelim- 
inary steps to be taken to enhance force survivability (such 
as preparing for a SAC take-off.) CINC NORAD’s assessment 
will contain either high or low confidence in what the 
sensors reveal. At this time, if the ground stations report 
a confirmation by more than one family of sensors, then CINC 
NORAD reports high confidence in the confirmed threat. 

3. The Missile Attac k Con feren ce 

If CINC NORAD's assessment to the President contains 
high confidence, CINC NORAD then convenes a missile attack 
conference which includes all senior personnel and the 
President. No missile attack conference has ever been 
called. To arrive at a missile attack conference, the 
conclusions of the two previous conferences revealed that an 
attack on North America is imminent. Since it takes time to 
convene these conferences, time is at a premium. 

B. UNCERTAINTY IN TBE DECISION-MAKING PROCESS 

Nuclear deterrence depends on maintaining the surviv- 
ability of strategic forces. Uncertainty involving the 
complete success of a missile attack on either the attack- 
er’s or defender’s side acts as a powerful deterrent since a 
first strike represents an unprecedented gamble. Intel- 
ligence information is rarely complete and when decision 
makers confront the uncertainty of a launch during a confer- 
ence, they must weigh the logical consequences of such an 
act and decide on a response to it. This deliberation 
continues to erode the time remaining before our missiles 
must be launched (or lost). 

In deploying offensive forces for the purpose of deter- 
ring war, the dominant peacetime objective is that of 
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preventing accidental or unauthorized use of weapons. 
Preventing errors of this type requires maintaining negativ e 
cont rol. Negative c ont rol means that a variety of physical 
constraints and organizational procedures make it highly 
unlikely for any one individual to fire any nuclear weapons. 
It is equally improbable that the necessary combination of 
people required to fire these weapons, in the absence of 
proper authority, could be organized. 

If war actually were to break out, the dominant objec- 
tive changes to the execution of retaliatory attacks. It 
then becomes important to minimize failures to launch 
weapons against preassigned targets. Preventing errors of 
this type requires p osit i ve control : the smooth operation 

and precise timing required to launch missiles. Negative 
and positive control inherently conflict; enhancing one 
diminishes the other to an extent determined by the details 
of the command arrangements for particular weapon systems 
[Ref. 9; p. 38]. 

The issue of positive and negative control brings up 
additional uncertainty, in the form of proper timing of a 
launch. The decentralization problem made by the great 
destructiveness of nuclear weapons emphasizes the conflict 
between positive and negative control. A single location, 
or even a few locations, can not control a modern strategic 
arsenal since these locations may be identified by the enemy 
and pre-emptively destroyed. Thus, many military officers 
at numerous locations (some mobile) maintain the physical 
ability to fire nuclear weapons, although authorization must 
be given and elaborate procedures followed. Since the 
Soviets have reputed to do the same, more uncertainty 
involving many more people with access to nuclear weapons 
comes into play. 

The response of the attacked nation is yet another 
uncertainty. It is impossible to predict in advance how the 
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politicians will act in the face of an actual attack. Arms 
control treaties enhance the uncertainty in intelligence and 
decision making when a possible launch arrives in the data 
gathering system, since a treaty is designed to "keep the 
peace." Because a surprise attack on our forces is practi- 
cally unimaginable in peacetime, human operators may hesi- 
tate and rely on the peacetime checks and balances designed 
to keep our forces from going to war accidentally. The key 
problems here involve our belief that nuclear attack and war 
are unthinkable, dampening our response behavior to launch, 
which reguires precise timing. Improving the warning 
sensors and the communication lines may ease the problem, 
but such improvements can not completely solve it. Because 
decades have passed without attack, and since the implica- 
tions of authorizing a nuclear war are unthinkable, the 
President, as well as other senior military personnel in 
charge of the response, may be unwilling to launch any 
missiles immediately upon receipt of the news of an 
impending attack. This hesitation in response could seal 
our fate. The longer the assessment and conferencing proce- 
dures take, the more opportunity the first striker has to 
attack again and further disrupt the reactions of the 
victim. The victim would have to meet the attacker's first 
strike with carefully planned strikes against the attacking 
nation’s sensor and warning systems, as well as against 
military forces, in order to disrupt the attacker's ability 
to engage in additional strikes. The victim must launch a 
retaliatory attack during, or soon after, the first strike. 

Unavoidable false alarms from the data gathering system, 
or from human error, contribute to the slowing of the deci- 
sion process, since it takes longer to confirm an alarm as 
false. While the complexity of the system does make us 
safer from accidental nuclear war, it only protects us 
against isolated failures. Multiple errors or malfunctions 
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invoke confusion in humans that leads to a longer resolution 
time of the alarm. Since the problem with compound errors, 
especially human ones, also increases the number of possible 
outcomes, no system can protect against all combinations. 

The likelihood that multiple events lead to trouble in- 
creases as the activity around a possible threat increases. 
Thus, the complexity of the warning system may amplify 
mistakes when forces are placed on alert. 

C. DECISION HODEL FORMULATION 

Let us assume that the Soviets have the ability to 
launch successfully a coordinated attack. Such an attack 
requires proper timing in order to minimize interference 
between exploding warheads in the same general area [Eef. 9: 
p. 39]. 

Again, we use a simple time line to model the decision- 
making process. We illustrate the decision process by 
including three examples: (1) an ICBM scenario, (2) an SLBM 

scenario, and (3) a test shot scenario. We assume that the 
time of flight of a missile is independent of decision- 
making time. Also, we assume that the decision process 
presented in Section A of this chapter pertains here. 

Again, we assume the timely detection of launched 
missiles. Timely detection and analysis by the sensors 
allows more time for the evaluation and decision-making 
process and for response to the threat as discussed in 
Chapter III. Also, we assume uninterrupted communications 
over the entire system. 

The Decision Model time line includes the incorporation 
of the different conferences, and the minimum time to reso- 
lution is the minimum amount of time in which the decision 
makers must decide to launch or not launch a counter-strike. 
Recall that, in any scenario, the way NORAD handles a 
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situation r ema ins the s am e. The same scenarios presented in 
Chapter III are now re-visited below: 

1 . The Gene ric Model 

This scenario describes a generic launch: 



time of flight I 1 | | | 1 1 I 1 1 

TO T 1 T2 T3 T4 T5 T6 T7 T8 T9 



la u nch 



im pact 



Figure 4. 1 The Generic Decision Model 



where TO = time of launch 

T1 = first detection 

T2 = system evaluation of launch (threat/no 
threat) 



T3 = missile display conference called 
T4 = second detection 

T5 = threat assessment conference called 

T6 = assessment of launch by decision makers 
(threat/no threat) 

T7 = missile attack conference called 

T8 = last possible time to decide on the type 
of response (launch/no launch) 

T9 = time of impact 

Thus, the minimum time to resolution is (T8-T4) . 

The suggested times in the following scenarios indi- 
cate reasonable times to impact for the purposes of discus- 
sion [Ref. 9: p. 393. 
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a. ICBM Scenario 



This scenario describes an ICBM launch: 

time TO T1 T2 T3 T4 T5 T6 T7 T8 T9 

flight i i I minutes 

launch impact 

Figure 4.2 An ICBM Scenario 

The definitions of TO through T9 remain the same and the 
minimum time to resolution is (T8-T4) = 22 minutes. 

b. SLBM Scenario 

This scenario describes an SLBM launch: 

time TO T 1 T2 T3 T4 T5 T6 T7 T8 T9 

flight *1 i~ i 1 k i ” li minutes 

launch impact 



Figure 4.3 An SLBM Scenario 

The definitions of TO through T9 remain the same. Thus, the 
minimum time to resolution is (T8-I4) = 4 minutes. 

c. Test Shot Scenario 

This scenario demonstrates how a test shot 
affects the decision-making process as shown in Figure 4. 4 
below. In this example, the minimum time to resolution is 
(T8-T4) = 4 minutes. Even if intelligence reports a test 
shot, the conferencing procedure continues as if it is an 
unknown threat. At T4, the data gathering system evaluates 
no threat based on the projected point of impact (usually 
the ocean) . Then, the decision makers realize it is a test 
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time 

of 

flight 



minutes 



TO T 1 T2 T3 T 4 T5 T6 T7 T8 T9 



launch impact 

Figure 4.4 A Test Shot Scenario 

shot, and CINC NORAD will not call a threat assessment 
conference. In this example, T5, T6 , T7 , and T8 may never 
occur; however the launch will continue to be monitored to 
gather as much intelligence data as possible. 

In the case of a launch indicator lacking dual 
phenomenology, at T4 , the decision makers assess the situ- 
ation and state whether they have high. or low confidence in 
what the data gathering system tells them. As before, the 
process continues until full confirmation is made or the 
sensors stop picking up the launch indicator. 

In the Decision Model, human intervention flays 
a key role which can not be over-emphasized. Human inter- 
vention is both a positive and a negative aspect; positive 
because more minds influence the decision-making process and 
because a launch in retaliation is not automatic but 
requires human intervention to activate the launch mecha- 
nisms. The negative aspects include the increased time it 
takes for a decision to be made by a team of decision 
makers. Moreover, these decision makers are only human and, 
therefore, prone to error. 

D. SENSITIVITY ANALYSIS 

Since the Decision Model is an extension of the Data 
Gathering Model, we will transfer the ideas from the sensi- 
tivity analysis of the Data Gathering Model to the sensi- 
tivity analysis of the Decision Model. In Figure 4.5 below, 
the corresponding points of the two models are shown: 
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The Data Gathering Model 



time 



of flight l~J— 1 



launch 



impact 



The Decision Model 



time 




launch 



impact 



Figure 4.5 Corresponding Points of the Two Models 

From our analysis of the Data Gathering Model, we 
observed that the time segments of the Decision Model are 
not as precise as shown in Section C of this chapter. These 
segments also overlap and one event may occur before 
another. We discuss this overlap problem in the examples 
below . 

1. The ICBM Thr eat 



tl , and t2 in the Data Gathering Model) take the same amount 
of time as described in Section F of Chapter III. However, 
the missile display conference T3 can not be called until T2 
= t2 occurs. At the point T3, the duty officers of all the 
command posts confer to decide if the threat is real or 
false. If no conflicting information arises, and the deci- 
sion makers readily agree, this decision-making process, 
which includes confirmation from the ground site, will take 
about 2 minutes. Figure 4.6 displays the time span and will 
be explained below. Note the independent overlap of T4 with 
T5, T6, and T7 : 



The events TO, Tl, and T2 (which correspond to tO , 
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time 

of 

flight 



<- T4 * 



minutes 



TO T1 T2 T3 T5 T6 T7 T8 T9 

I i 2- 1 5 i 6 1 5 ~~Vl~ 3(1 



lauQch impact 

Figure 4.6 Decision Hodel Time Line for an ICBM Scenario 

During this conferencing procedure, the data gath- 
ering system continues to monitor the launch phenomenon. As 
stated previously in the Data Gathering Hodel, the time to 
obtain a second detection at T4 (dual phenomenology) could 
take anywhere from 3 to 7 minutes, depending on the 
missile's trajectory. (Here, T4 corresponds to t3 in the 
Data Gathering Hodel.) This means that the minimum time 
(shortest interval) to T4 is still about 5.5 minutes and the 
maximum time (longest interval) is about 9.5 minutes, but 
the missile display conference T3 will occur prior to the 
second detection T4. Even if dual phenomenology does not 
occur after T3, CINC NORAD will call a threat assessment 
conference at T5. If T4 = 5.5 minutes, then CINC NORAD will 
have high confidence before going on to T5 , and the threat 
assessment conference will probably last about one minute. 
However, if T4 = 9.5 minutes (or longer), this will not be 
the case. The decision makers will probably want more time 
to assess the situation, hoping to obtain dual phenomenology 
before going on to the missile attack conference at T7. By 
T6, however, the decision makers will have made their 
assessment (with or without dual phenomenology). Then, CINC 
NORAD will call the missile attack conference, reporting 
either high or low confidence in the assessment to the 
President. 

In the minimum (shortest interval) case, with 
T4 = 5.5 minutes, if the missile display conference and the 
threat assessment conference take 1 minute each (overlapping 



57 



with T4) , (T7-T6) = 30 seconds, and if the missile attack 

conference takes about 1 minute, then the President would 
have (T8-T7) = 2 0.5 minutes to decide on his response and 
23.5 minutes to impact at T9. However, if any of the 
conferences (T3 , T5, T7) take longer than above, the time 
between T7 and T8 will be shortened, leaving less time for 
the President to make his decision. 

In the maximum case, without waiting for dual pheno- 
menology, the President would still have 20.5 minutes to 
decide on his response, but he would be working with a low 
confidence assessment. Any President is likely to be reluc- 
tant in giving an order to retaliate without high confi- 
dence. Thus, if T4 = 9.5 minutes and CINC NORAD waits for 
dual phenomenology (although T5, T6, and T7 would still 
occur while waiting) , then the President would have (T8-T7) 

= 17.5 minutes. If the interval between T8 and T9 is actu- 
ally 6 minutes (as proposed in Section F of Chapter III) , 
this would allow the President 17.5 minutes in the minimum 
case and 13.5 minutes in the maximum case. The question of 
waiting for dual phenomenology, therefore, becomes an impor- 
tant one. We discuss the implications of various launch 
policies which bear on this issue in Chapter 7. 

2. The SL3M Threat 

The time intervals up to and including T6 remain the 
same here as in the ICBM scenario. But the situation 
becomes more stressful with the shorter time of flight for 
an SLBM with the addition of conferences. Again, the situ- 
ation regarding depressed, lofted, and minimum energy 
trajectories of SLBMs applies here. The requirement for 
dual phenomenology increases the time between T2 and T4 
(corresponding to t2 and t3 in the Data Gathering Model) 
when the S1BM is in a depressed trajectory. The same result 
occurs if a submarine launches its SLBMs close to the coast 
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as described in Chapter III. Figure 4.7 shows the time span 
for an SLBM threat: 

time TO T1 T2 T3 T4 T5 T6 T7 T8 T9 

flight A A 2 ! 5 A I A A 6 1 5 A 1 A minutes 

launch impact 

Figure 4.7 Decision Model Time Line for an SLBM Scenario 

The minimum time to T4 is 5.5 minutes. This time 
permits only 3.5 minutes total decision-making time before a 
response is required from the President and only 6.5 minutes 
before impact of the missile. If the maximum time is 
(T4-T0) =9.5 minutes, then no decision-making time exists, 

and only 2.5 minutes remain to impact. As we mentioned 
earlier, T4 overlaps T5 (T3 has already occurred) . The 
events T6, T7, and T8 can occur prior to T4 if the President 
is willing to make a decision with a low confidence assess- 
ment. However, if he requires dual phenomenology, T8 can 
not occur until T4 occurs, thus, shortening the final 
decision-making time. Any President with peaceful inten- 
tions will wait until T4 occurs before giving an order to 
retaliate. In the minimum case, the President has (T8-T7) = 
2.5 minutes to make his response. In the maximum case, the 
President has no time left. 

With 6 minutes vice 3 minutes as the minimum time to 
perform a launch sequence, that is, (T9-T8) = 6 minutes, the 
President would have no time to think if (T4-T0) =9.5 

minutes and dual phenomenology is required. In any case, 
the conferences will have to be rushed (perhaps only 30 
seconds apiece), if any assessment is to be given to the 
President in time to launch a retaliatory strike (if that is 
the President’s chosen response.) Because of this extremely 
shortened time interval, the President may be forced to make 
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a decision with a low confidence assessment from CINC NORAD, 
if dual phenomenology does not occur within 9 minutes after 
a launch of an SLBM attack. 
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V. THE PROBABILITY OF ACCIDENTAL NUCLEAR WAR 



A. INTRODUCTION 

In this chapter, we combine the Data Gathering Model and 
the Decision Model to show the implications of policies such 
as l aunch-on- war ni ng and lau nch-u nder-at tack for the early 
warning system. We first describe the segment of the time 
line that affects the decision to use one of these policies. 
We assume the United States is operating under peacetime 
conditions in this discussion. The time lines in Figure 5. 1 
represent the intervals of time during which launch policies 
affect future decisions: 

The Data Gathering Model 

time of flight I | 1 | 1 1 1 I 1 

to tl t2 t3 t4 t5 

launch 



The Decision Model 




launch 

Figure 5-1 Affective Segment of the Time Line 



The affective time lines do not include impact since after 
T8 (t5) , no time remains to launch effectively a retaliatory 
strike. Also, recall that a false alarm occurs if (1) a 
launch detection occurs; (2) the data gathering system 
labels it a threat by T2 when no threat exists; and (3) a 
threat assessment conference is called at T5 before confir- 
mation of the threat. 



The following data comes from NORAD [Bef. 10] and shows 
the number of conferences called from 1977-1983, including 
the false alarms discussed earlier in Chapter II: 



TABLE II 

Emergency Action Conferences by Year 



YEAR 


BOOTINE MISSILE 

ETEPCII 

CO EFEEE TICES 


CONFEEENCES CALLED 
~TO“EVSEtJATE 


THEE AT 
ASEEEEEENT 
CPETFEKETTCE S 


1977 


1567 


43 


0 


1978 


1009 


70 


2 


1979 


1544 


78 


2 


1980 


381 5 


149 


2 


1981 


285 1 


186 


0 


1982 


371 6 


218 


0 


1983 


3294 


255 


0 



The routine missile display conferences do not fit any 
of the previous definitions we used and, therefore, will not 
be considered in this analysis. Note the number of confer- 
ences called to evaluate possible threats (these are the 
missile display conferences, as we defined them earlier). 

The numbers appear to increase as the years progress. 
However, we explained the cause of this behavior in Chapter 
II. The false alarms that occurred in 1978, 1979, and 1980 
resulted in the threat assessment conferences that were 
called. However, in those cases, confirmation of the threat 
was not made: in each case, the response from the site 

indicated that a threat did not exist. In fact, the site 
had absolutely no indication of a launch on their display. 
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The procedures followed in those years differ from the way 
CINC NORAD currently calls threat assessment conferences. 
Today, if no confirmation comes from the site, CINC NORAD 
probably will stop the conferencing process at that point to 
determine if there is a failure at NCMC. Thus, a threat 
assessment conference may not be called. If the site 
reports launch and impact points in close agreement with 
NORAD’s incoming data, this confirmation gives at least a 
low confidence assessment, and CINC NORAD will continue the 
conferencing procedure by calling a threat assessment 
conference. Nevertheless, in the analysis of the next two 
sections, we use the above table as if the threat assessment 
conferencing situations are the same (as described in 
Chapter 17) . 

B. POLICY TYPES AND DISCDSSION 

Fe begin this discussion with the la un c h -on - wa rning 
case, because of its simplicity. The United States does not 
currently have such a policy; however, there are many advo- 
cates of l aun ch- on - w arning, since this policy improves reac- 
tion time in performing a counter-strike launch. 

1 . Launc h -On-Warni ng 

Launch -on- wa rni ng means that upon detecting the 
launch of an enemy’s missiles and confirming the threat at 
the site (albeit with low confidence), we would launch some 
fraction of the threatened ICBM force before those missiles 
reached any of their targets. 

This extremely broad definition contains several 
important implications. For instance, to carry out a 
launch-on-warning policy in the event of an actual enemy 
missile launch, the decision makers must declare the threat 
confirmed; that is, the data gathering system and the 
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decision makers both must agree that the situation is a 
confirmed threat situation. Then, CINC NORAD reports low 
confidence in the assessment to the President. A launch-on- 
warning stance presumably allows more time for the bomber 
forces to escape and increases the amount of time to execute 
a counter-strike. The SLBM scenario, described in Chapter 
IV, makes the importance of these two features extremely 
apparent. 

Dsing the table from Section A, we can now ask the 
question, "How often does a false alarm occur in the case of 
a single system failure?" Recall that threat assessment 
conferences were called in the situations where a false 
launch indication occurred; 6 times over 6 years. Thus, the 
average arrival rate is one per year (for a single detection 
with lew confidence) . 

Adopting a launch-on-warning policy in peacetime 
implies that if a single failure occurs in the system, and 
the site confirms the threat, then the following sequence of 
events may take place; 

time of flight | 1 1 | 1 — | | 

TO T1 T2 T3 T5 T6 T7 

launch shoot! 

Figure 5.2 Launch-On-Warning Time Line 

Note the change to the Decision Model — the decision maker 
does not wait for T4 (second detection from a different 
family of sensors) to occur before giving an assessment to 
the President. The President also does not necessarily wait 
for a second detection to give a launch order. 

Thus, a lower bound for the expected waiting time 
until an accidental nuclear war is 1 year, if the President 
choo ses to retaliate under the conditions just described. 
What makes this a lower bound is the fact that a false alarm 
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must persist long enough without dual phenomenology to 
convince the President to act with only a low confidence 
assessment. 

In any case, launch-on-warning is a high risk 
policy, especially when great international tensions exist 
between the United States and the USSR, as they do today. 

In peacetime, a single failure without dual phenomenology 
puts the President in the extremely difficult position of 
deciding how long to wait before giving an order to launch a 
coun ter-strike. 

2 . Launc h-U nder-Attack 

The presence of dual phenomenology (the confirmation 
of a launch by two families of sensors) gives much more 
reliability to a confirmed threat. In previous chapters, we 
demonstrated how much the decision makers rely on dual 
phenomenology to reduce the chance of an incorrect response. 
We now discuss how much better the warning system actually 
becomes. 

Currently, the United States has a laun c h-unde r- 
attack policy. In this thesis, launch - u nd er-at t ack means 
launching some fraction of the threatened ICBM force when 
the early warning system confirms a threat and that threat 
is assessed with high confidence. Again, the data gathering 
system and the decision makers must agree in their assess- 
ment that the threat is confirmed, as in launch-on-warning. 
The conditions of dual phenomenology and a predicted impact 
point in friendly territory define the confirmed threat. 

The difference in this policy arises from CINC NORAD's 
assessment to the President: here, CINC NORAD reports high 

confidence in what the sensors reveal, since dual phenome- 
nology is required. The President is still the responsible 
authority for the initiation of the launch: whether it is 

one missile or many missiles, the decision to implement a 
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launch-under-attack rests with the President. An advantage 
to this policy is that a launch-under-attack lessens the 
probability of accidental nuclear war while maintaining a 
strong deterrence. 

If the Onited States continues to follow a launch- 
under-attack policy, what sequence of events must occur to 
cause an accidental nuclear war? Since under launch-under- 
attack, the Onited States would not launch a retaliatory 
strike if only one system failed, a necessary condition for 
accidental nuclear war, in this case, is for two different 
false alarms on two different sensors to occur. Plus, the 
false alarm on one system must overlap the false alarm on 
the other system. Moreover, the two systems must agree 
approximately on the launch and impact points, so that the 
decision maker sees the same launch phenomenon on two sepa- 
rate systems. Ihe overlap time must also be of sufficient 
duration to allow enough time to launch a countar-strike. 

In Chapter IV, we assumed three minutes (initially) to carry 
out the launch order. 

first false alarm 

l 

i — '-f; 1 

l I 
I i 

i overlap time 

r-iV 

I 

second false alarm 
Figure 5.3 The Interval Overlap 

The minimum overlap time, then, is defined as the intersec- 
tion of two false alarm intervals for at least 3 minutes. 

In Figure 5.3 above, we assume that the time intervals are 
stochastically independent, and so are the false alarms in 



radar 

system 

false alarms 



infrared 

system 

false alarms 
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the two systems. If we assume that the arrival process of 
the false alarms is a Poisson process, the intervals between 
arrivals are exponentially distributed. 

In order to calculate an upper bound for the prob- 
ability of a double false alarm using dual phenomenology (a 
double false alarm on two different systems) , we assume the 
following: 

1. We disregard the difference between the false alarms 
on the two different systems (assumed above). 

2. The combined rate of the radar false alarms and 
infrared false alarms is one false alarm per year. 

3. The time between arrivals of the combined false alarms 
is exponentially distributed. 

If all these false alarms involve ICBM launches 
only, what is the probability that two successive false 
alarms occur within 27 minutes of each other (i. e., a 3 
minute overlap) ? Let 

X = the time between false alarms 



then 

P(X < k minutes) = l-e*'" 

= 1 - £1 ♦ (-Xk) ♦ (-Xk) 2 /2! + . . .) 

where X is one per year (that is, the mean time to wait for 
a false alarm is 6/6, or one year). Dropping all but the 
first three terms gives 

P (X < k minutes) Xk 
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in minutes. Note that the units for X and k must conform. 
Since we assumed that it takes at least 3 minutes to execute 
a counter-strike launch, at least a 3 minute overlap is 
necessary. This is the "worst case" situation. 

The upper bound (worst case) for an ICBH scenario is 
in the situation where a 3 minute overlap occurs. Here, the 
calculation gives 

P (X < 27 minutes) = 27/(365) (24) (60) 

= 0.000051 

Therefore, a lower bound for the expected waiting time of 
this event is 1/0.000051 which is approximately 19,467 
years. These calculations are very restrictive since we 
have assumed a combined false alarm rate. This assumption 
means that two sensors could fail in the same family. From 
what we have described, we must have false alarms from two 
families of sensors. This makes the probability even lower 
than 0.000051 and the expected waiting time greater than 
19, 467 years. 

The upper bound for an SLBti scenario is for a 3 
minute overlap to occur: 

P(second false alarm occurs < 9 minutes) = 9/(365) (24) (60) 

= 0.000017 

In this case, the expected waiting time to a double false 
alarm is approximately 58,400 years. The upper and lower 
bounds of the ICBM scenario cover this and all other 
situations. 

In conclusion, the United States will probably never 
accidentally launch a retaliatory strike with a launch- 
under-attack policy, if the false alarm rate remains the 
same as in Table II. The graph in Figure 5.4 shows how the 
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expected waiting time varies with different lambdas. 
However, Adding sabotage and nuclear proliferation raises 
the probability and decreases the expected waiting time. 
Nevertheless, with these probabilities as upper bounds, a 
decision maker will pause and take time to analyze false 
alarms under these conditions. 



a 




Figure 5.4 Expected Waiting Time Versus Lambda 



These same calculations assist the decision maker in 
determining whether an alarm is real or false by adding the 
conferencing procedure. If the decision maker decides the 
first alarm is false, then when a second alarm occurs, it 
merely supports the fact that a system failure has occurred. 
Also, including the conferencing procedure may add more time 
to the process, allowing for the possibility of the alarm 
being confirmed by dual phenomenology, or evaluated as no 
threat. 
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This addition of time to the decision-making process 
could be a blessing in disguise. If the system gives a 10 
minute impact time, but the decision-making process already 
has taken 15 minutes, then probably no launch 'has occurred. 
Thus, if no impact materializes by the 10 minute limit, and 
the decision makers still have not reached a decision, the 
conferencing procedure, again, will probably stop. 

C. SUHHAHY 

Sophisticated systems to warn of nuclear attack are 
necessary for the protection of the United States. Also, if 
the Soviets know that the United States has an effective 
warning system, they are less likely to initiate an attack. 
Since both the United States and the USSR possess effective 
warning systems, both sides have less incentive to launch an 
attack, and the world is more stable as a result. 

The Missile Attack Warning System is designed to make 
sure that the decision to go to war is not driven by a flock 
of geese or a defective computer chip. A human is always in 
the decision loop. 

Although the launch-on-warning policy would improve 
reaction time in performing a counter-strike launch, it 
seriously impairs rational decision making in a time of 
extreme stress. A launch-on-warning policy puts the 
President in the "hot" seat nearly once per year. But such 
a burden, even once every 4-year term, would be enough for 
any President. The risk of accidental nuclear war under 
launch-on-warning is great enough to make this policy very 
unattractive. 

Launch-under-attack, on the other hand, is much safer, 
given its requirement for dual phenomenology. The condi- 
tions necessary for a double false alarm (a false alarm in 
two separate systems) to occur in a time overlap of at least 
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3 minutes make the probability of accidental nuclear war 
extremely small. The President must still undergo immense 
pressure, but he can be virtually assured of making the 
correct response decision. 



appendix A 

ACRONYMS AND ABBREVIATIONS 



ADCOM 


Aerospace Defense Command 


AN SCC 


Alternate National Military Command Center 


BMEWS 


Ballistic Missile Early Warning System 


CINC NO RAD 


Commander-in-Chief, North American 




Aerospace Defense Command 


CINC SAC 


Commander-in-Chief, Strategic Air Command 


DEW 


Distant Early Warning Line 


EMP 


Electromagnetic Pulse 


ICBM 


Intercontinental Ballistic Missile 


JCS 


Joint Chiefs of Staff 


MIRV 


Multiple Independently Targeted Re-entry 




Vehicle 


NCA 


National Command Authority 


NCSC 


North American Aerospace Defense Command 




Cheyenne Mountain Complex 


NMCC 


National Military Command Center 


NORAD 


North American Aerospace Defense Command 


PARCS 


Perimeter Acquisition Radar Attack 




Characterization System 


SAC 


Strategic Air Command 


SEWS 


Satellite Early Warning System 
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SLBM 


Submarine-Launched Ballistic Missile 


SOS US 


Sound Surveillance System 


SPASUR 


United States Navy Space Surveillance Network 


SRF 


(Soviet) Strategic Rocket Forces 
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